Network Service Discovery
Registry Run Keys / Startup Folder
External Proxy
Deobfuscate/Decode Files or Information
Keylogging
Data from Local System
PowerShell
Clipboard Data
OS Credential Dumping
Code Signing Policy Modification
AppInit DLLs
Shortcut Modification
Network Share Discovery
Service Execution
Encrypted/Encoded File
Tool
Remote Desktop Protocol
System Owner/User Discovery
Software Packing
Exfiltration Over C2 Channel
Malicious File
Scheduled Task
File Deletion
Bidirectional Communication
Archive via Utility
Web Shell
Ingress Tool Transfer
AutoHotKey & AutoIT
Malicious Link
Credentials from Password Stores
Screen Capture
LSASS Memory
Remote System Discovery
DNS
Command and Scripting Interpreter
Local Data Staging
File and Directory Discovery
Query Registry
Brute Force
BITS Jobs
Local Account
Python
Match Legitimate Resource Name or Location
Web Protocols
Internal Proxy
Valid Accounts
Input Capture
Spearphishing Link
Spearphishing Attachment
SMB/Windows Admin Shares
Exploit Public-Facing Application
Visual Basic
SSH